MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e7b1bd921cbfbbc4dea263e444d59c9c0f28b18f9b1a2c57a9bec5a1a6766f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4e7b1bd921cbfbbc4dea263e444d59c9c0f28b18f9b1a2c57a9bec5a1a6766f5
SHA3-384 hash:	bb9bb7aa112132c42051a6f7f049d54013f3f3fd16db5e1cd93ace81a571d702f4596a367c1740eedb4eaa576b84c4ea
SHA1 hash:	9db8c77fd8967858df5d367f26217d22dbd832d4
MD5 hash:	d9cf88564079f0d7a40e6916f536de1f
humanhash:	harry-chicken-missouri-river
File name:	Profile_AXIN0626Sample.js
Download:	download sample
Signature	AveMariaRAT Alert Create hunting rule
File size:	74'313 bytes
First seen:	2026-06-23 08:03:07 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	768:r+UbF7Sx5zOMFRbY7+1O+5wHqJjPRSyuWEmLfaYsdP4kcNadr4gCLxH2Jid8qsAw:Ogc3GZ
TLSH	T1D37322F02EC2B2F82619DA97EDBA6C9184F143454EE462BB05D2108FF865ADB4DF3744
Magika	javascript
Reporter	abuse_ch
Tags:	AveMariaRAT js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

148

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.58617162.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a3a3ea81548daf709f914c1

Tags:

ransomware hype

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-vm fingerprint repaired

Link:

https://www.filescan.io/uploads/6a3a3e229799578a6c474dfa/reports/372e03cb-e283-4ea7-a815-e95d90b9a2db/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/4e7b1bd921cbfbbc4dea263e444d59c9c0f28b18f9b1a2c57a9bec5a1a6766f5

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-22T18:37:00Z UTC

Last seen:

2026-06-24T05:52:00Z UTC

Hits:

~100

Detections:

Trojan.JS.SAgent.sb Trojan-Downloader.Agent.HTTP.ServerRequest HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/4e7b1bd921cbfbbc4dea263e444d59c9c0f28b18f9b1a2c57a9bec5a1a6766f5/results?tab=lookup

Joe Sandbox AveMaria, KeyLogger, MicroClip

Result

Threat name:

AveMaria, KeyLogger, MicroClip

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1932411

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

Contains functionality to compare user and computer (likely to detect sandboxes)

Creates processes via WMI

Early bird code injection technique detected

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Installs a global keyboard hook

JavaScript source code contains functionality to generate code involving a shell, file or stream

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Queues an APC in another process (thread injection)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Net WebClient Casing Anomalies

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Powershell Decrypt And Execute Base64 Data

Sigma detected: Suspicious PowerShell IEX Execution Patterns

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected AntiVM3

Yara detected AveMaria stealer

Yara detected Keylogger Generic

Yara detected MicroClip

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4e7b1bd921cbfbbc4dea263e444d59c9c0f28b18f9b1a2c57a9bec5a1a6766f5

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4e7b1bd921cbfbbc4dea263e444d59c9c0f28b18f9b1a2c57a9bec5a1a6766f5/

Neiki Family.REVERSELOADER

Verdict:

Malicious

Threat:

Family.REVERSELOADER

Link:

https://tip.neiki.dev/file/4e7b1bd921cbfbbc4dea263e444d59c9c0f28b18f9b1a2c57a9bec5a1a6766f5

ReversingLabs TitaniumCloud Script-JS.Trojan.Cryxos

Threat name:

Script-JS.Trojan.Cryxos

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-22 23:14:50 UTC

File Type:

Text (JavaScript)

AV detection:

8 of 36 (22.22%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jz5rxwjbzp53ytpkey7eitkzzhapfcyy7gy2frl2tpwfugthm32q._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution

Link:

https://tria.ge/reports/260623-jyq3dabs3k/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Badlisted process makes network request

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4e7b1bd921cbfbbc4dea263e444d59c9c0f28b18f9b1a2c57a9bec5a1a6766f5